Real-time detection method for mobile network traffic anomalies considering user behavior security monitoring

Zhang, Huabing; Ye, Sisi; Cao, Xiaoming; Zhida, Lin

doi:10.1109/cbfd52659.2021.00010

Cited by 2 publications

(1 citation statement)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Attackers continually devise new tools and techniques to breach network defenses. Therefore, the timely and accurate detection of anomalies and intrusions is paramount for ensuring network security [1]. This requires advanced analytical methods and technologies capable of identifying suspicious patterns and behaviors amidst the vast sea of network traffic data, enabling proactive defense measures to mitigate potential threats effectively [2].…”

Section: Introductionmentioning

confidence: 99%

Real-Time Detection of Network Traffic Anomalies in Big Data Environments Using Deep Learning Models

Arjunan

2024

IJRASET

View full text Add to dashboard Cite

In light of the increasing sophistication of cyberattacks and the rapid growth in network traffic, it is essential to detect network traffic anomalies or intrusions as they occur. Manual inspection is inefficient due to the large volume, speed, and variety network traffic data. This paper suggests using deep learning techniques in order to build intelligent models which can detect network traffic anomalies automatically within big data environments. We present a framework for anomaly detection using long-short-term memory models (LSTM) and convolutional neural network (CNN). The models are based on data extracted from packet captures. The models are evaluated on benchmark intrusion datasets as well as a large scale real network traffic dataset. The results show that deep learning models are able to detect anomalies more effectively than traditional shallow learning methods. Models can handle high-volume streaming data with low latency and in real time. To improve detection efficiency, we also propose optimization methods such as model compression and transfer learning. This work shows the effectiveness of deep learning for real-time anomaly detection within big data environments

show abstract

Section: Introductionmentioning

confidence: 99%

Real-Time Detection of Network Traffic Anomalies in Big Data Environments Using Deep Learning Models

Arjunan

2024

IJRASET

View full text Add to dashboard Cite

show abstract

F3l: an automated and secure function-level low-overhead labeled encrypted traffic dataset construction method for IM in Android

Xu,

Cheng

2024

Cybersecurity

View full text Add to dashboard Cite

Fine-grained function-level encrypted traffic classification is an essential approach to maintaining network security. Machine learning and deep learning have become mainstream methods to analyze traffic, and labeled dataset construction is the basis. Android occupies a huge share of the mobile operating system market. Instant Messaging (IM) applications are important tools for people communication. But such applications have complex functions which frequently switched, so it is difficult to obtain function-level labels. The existing function-level public datasets in Android are rare and noisy, leading to research stagnation. Most labeled samples are collected with WLAN devices, which cannot exclude the operating system background traffic. At the same time, other datasets need to obtain root permission or use scripts to simulate user behavior. These collecting methods either destroy the security of the mobile device or ignore the real operation features of users with coarse-grained. Previous work (Chen et al. in Appl Sci 12(22):11731, 2022) proposed a one-stop automated encrypted traffic labeled sample collection, construction, and correlation system, A3C, running at the application-level in Android. This paper analyzes the display characteristics of IM and proposes a function-level low-overhead labeled encrypted traffic datasets construction method for Android, F3L. The supplementary method to A3C monitors UI controls and layouts of the Android system in the foreground. It selects the feature fields of attributes of them for different in-app functions to build an in-app function label matching library for target applications and in-app functions. The deviation of timestamp between function invocation and label identification completion is calibrated to cut traffic samples and map them to corresponding labels. Experiments show that the method can match the correct label within 3 s after the user operation.

show abstract

Real-time detection method for mobile network traffic anomalies considering user behavior security monitoring

Cited by 2 publications

References 18 publications

Real-Time Detection of Network Traffic Anomalies in Big Data Environments Using Deep Learning Models

Real-Time Detection of Network Traffic Anomalies in Big Data Environments Using Deep Learning Models

F3l: an automated and secure function-level low-overhead labeled encrypted traffic dataset construction method for IM in Android

Contact Info

Product

Resources

About